The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is designed to search through local agent runtime directories, specifically ~/.claude/projects/ and ~/.cursor/, to extract session identifiers. While this is used to label the bug report, it involves accessing internal application data paths. Furthermore, the PII redaction policy explicitly excludes several types of identifiers from masking—such as user IDs, project IDs, asset IDs, and flow IDs—which results in their exposure within the generated Markdown report.
[INDIRECT_PROMPT_INJECTION]: The workflow ingests untrusted data from conversation history and tool outputs to reconstruct a session transcript, creating a potential surface for indirect prompt injection if malicious content is present in the source data.
Ingestion points: User messages, assistant responses, and tool results from the active session (defined in SKILL.md, Workflow Step 2).
Boundary markers: The skill uses markdown code fences (```text) to enclose ingested text blocks, but does not provide explicit "ignore instructions" warnings for the agent processing the resulting file.
Capability inventory: The skill possesses the capability to read session history, invoke diagnostic MCP tools, and write files to the local filesystem.
Sanitization: A PII redaction rule is applied to mask sensitive personal information, though it is not designed to sanitize against markdown or prompt injection; the skill relies on host agent guardrails.
[COMMAND_EXECUTION]: The skill performs file system operations to save reports locally. It includes a security control for the --name argument that rejects path separators and parent directory references (..), which helps prevent path traversal attacks.

di-agent-bug-report